Not legal advice

dpdpkit is software that helps you implement obligations under India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It does not provide legal advice and does not guarantee compliance.

Rights requests¶

rights ¶

Rights requests and grievances: access, correction, completion, updating, erasure, nomination.

Deadlines come from the policy pack: due_at is the published target, max_due_at the ceiling (Rule 14(3) for grievances). Every transition writes an audit entry before the request is saved.

RightsService ¶

RightsService(kit: Kit)

open ¶

open(principal: str, kind: RequestKind | str, details: dict[str, Any] | None = None, *, actor: str | None = None) -> RightsRequest

get ¶

get(request_id: str, principal: str | None = None) -> RightsRequest

list_requests ¶

list_requests(*, principal: str | None = None, statuses: Collection[RequestStatus] | None = None, open_only: bool = False) -> list[RightsRequest]

nominees ¶

nominees(principal: str) -> list[Nominee]

sla ¶

sla(req: RightsRequest, now: datetime | None = None) -> SlaStatus

overdue ¶

overdue(now: datetime | None = None) -> list[RightsRequest]

assign ¶

assign(request_id: str, assignee: str, *, actor: str) -> RightsRequest

verify_identity ¶

verify_identity(request_id: str, verified: bool, *, actor: str, method: str | None = None) -> RightsRequest

start ¶

start(request_id: str, *, actor: str) -> RightsRequest

respond ¶

respond(request_id: str, message: str, *, actor: str, outcome: str = 'completed') -> RightsRequest

Complete a request with a response. The fiduciary's contact details are always attached (Rule 9).

reject ¶

reject(request_id: str, reason: str, *, actor: str) -> RightsRequest

IdentityVerifier ¶

Bases: Protocol

Hook called when a request opens. Start an out-of-band check (OTP, KYC, DigiLocker…), then report the result with RightsService.verify_identity.

begin ¶

begin(request: RightsRequest) -> None